Clash Controller

This skill primarily talks to the local Clash for Windows REST API and otherwise looks low-risk, but there are a few red flags you should act on before installing: - The code contains a hardcoded API secret. That means the skill will only work if your Clash external-controller secret exactly matches that value; otherwise it will fail. Consider editing the skill to read the secret from your Clash config or from an environment variable, or change your Clash secret to something you control. Never publish a secret you care about inside a skill bundle. - The SKILL.md claims the skill can start/stop the Clash process, but the shipped code does not implement process control. If you need process-level control, request or inspect an implementation that uses safe, explicit process APIs instead of relying on undocumented behavior. - Confirm External Controller is intentionally enabled on your machine and that you are comfortable granting the agent the ability to change proxy routing via that API — it can alter how your network traffic is routed (not exfiltrate data externally, but can change connectivity). If you are not comfortable editing code, or you don't want an agent able to toggle your system proxy, do not install. If you proceed, review and remove the hardcoded secret or replace it with a read-from-config/env implementation, test in a safe environment, and consider limiting autonomous invocation of the agent that will use this skill.